Juniper SRX Series

Chapter 14. Unified Threat Management

Unified Threat Management (UTM) is an industry term that was coined to define Layer 7 protection against client-side threats. This does not include IPS (which also has protection against server-to-client attacks) but rather technologies such as network-based antivirus protection, URL filtering, antispam solutions, and content filtering. At this point, you might be asking yourself, if you have an IPS, why you need UTM? It’s an excellent question, and one that many administrators confuse. IPS is primarily focused on network-based attacks on protocols, and is stream based, meaning that it processes traffic inline without modifying it as a stream. This works great from a performance perspective to detect attacks against services and applications. UTM, on the other hand, is meant more for protecting against files that are transmitted on top of the network streams. Although IPS might be more geared for detecting an overflow of the parser of the network stream, it isn’t as well geared for detecting threats within files. That is, it certainly can detect such file-based attacks, but attackers can go to great lengths to encode, encrypt, and obfuscate files to perform some malicious action—and it is very difficult to detect these attacks in Stream mode.

If you think about it, network-based vulnerabilities have a very specific and fixed attack surface for the individual vulnerabilities, where, say, executables can be programmed to do virtually anything, ...